Legal
Privacy
Policy
How Pewa Change Party ("the Party", "we") handles your personal data when you use pewachange.org. Written to the Data Protection Act, 2019.
Last updated: August 2026. Contact / Data Protection queries: info@pewachange.ke.
1. Who is the data controller
Pewa Change Party is the data controller for information collected through this website. Reach us at info@pewachange.ke or +254 100 540 540.
2. What we collect and why
| When you… | We collect | Purpose & lawful basis |
|---|---|---|
| Join as a member | Full name, national ID or passport number, date of birth, gender, phone, email, county / constituency / ward, voter status, how you'd like to help, your message. | To register and maintain the Party's membership records as required by the Political Parties Act, and to contact you about Party activities. Basis: your consent, and compliance with a legal obligation. |
| Post to Sauti ya Wananchi | The name you choose to give (or "Anonymous"), county, topic, and your message. | To hear and, after moderation, publish public feedback. Basis: your consent. |
| Sign up to volunteer | Name, phone, email, location, skills, availability, message. | To organise volunteering and contact you about it. Basis: your consent. |
| Declare interest as an aspirant | Name, phone, email, the seat you intend to contest, location, bio, LinkedIn. | To run the Party's nomination process; if approved, to publish your name, seat and bio. Basis: your consent. |
| Contribute funds | We do not collect card or M-Pesa PINs. Contribution records (name, amount, date) come to us from the payment channel. | To account for Party funds and comply with the Election Campaign Financing Act. Basis: legal obligation. |
| Any form submission | Your IP address, browser type and the time, kept briefly. | Security and spam prevention. Basis: our legitimate interest. |
We do not use advertising cookies or third-party trackers. The site sets no cookies except a short-lived session cookie inside the staff admin area.
3. Sensitive data
A national ID / passport number is sensitive. We ask for it only to verify membership eligibility as the law requires. It is stored with restricted access (see our Data Protection & Security Policy) and is never published or shared for marketing.
4. Where your data is held, and transfers outside Kenya
Pewa Change Party's website, database and email run on secure, cloud-based service providers. Your data sits in a database that is not publicly accessible, with working copies in the Party's office systems.
Some of these providers store and process data outside Kenya, within the European Union. Their services are contractually bound by EU data-protection law (the GDPR) — a regime the Data Protection Act, 2019 recognises as offering protection equivalent to Kenya's. We rely on your consent for this transfer, given when you submit a form, and all data is encrypted in transit (HTTPS). If you would prefer your data not be transferred outside Kenya, do not submit the form — contact us instead. Messages you send to our WhatsApp line are additionally handled by WhatsApp.
5. Who we share it with
Only Party officials and staff who need it for the purposes above, and the cloud-based service providers that host our website, database and email (bound by EU data-protection law); a current list of these providers is kept in the Party's internal processor register. We will disclose data if required by law, a court, the Registrar of Political Parties, the IEBC or the Office of the Data Protection Commissioner. We never sell your data.
6. How long we keep it
- Members — for as long as you are a member and up to 5 years after, then archived or deleted, unless the law requires longer.
- Concerns — approved posts stay published until you ask us to take them down; unpublished ones are reviewed and cleared periodically.
- Volunteers — up to 2 years after your last activity.
- Aspirants — for the electoral cycle; rejected declarations are deleted within 6 months.
- Security logs (IP) — up to 24 hours in the live system.
7. Your rights
Under the Data Protection Act, 2019 you may ask us to give you a copy of your data, correct it, delete it, restrict or stop our use of it, or provide it in a portable form. Email info@pewachange.ke and we will respond within the statutory timeline. You may also complain to the Office of the Data Protection Commissioner (odpc.go.ke).
8. Security & breaches
Our safeguards are set out in the Data Protection & Security Policy. If a breach is likely to harm you, we will notify you and the Data Protection Commissioner within 72 hours of becoming aware of it.
9. Children
Membership is for persons aged 18 and above. We do not knowingly collect data from children. Tell us if you believe we have, and we will delete it.
10. Changes
We may update this policy. The "last updated" date above shows when. Material changes will be announced on this site.